Anonymisation of Internet data often not secure

In an interview with the German Press Agency, Ulrich Kelber (Federal Data Protection Commissioner) calls for more reliability and clarity with regard to anonymised Internet data. Often it is only pseudonymised data. This is not real protection. We explain the difference.

Background information on anonymization

The consent of processing personal data such as name or address is not required for anonymised data according to the European General Data Protection Regulation. According to recital 26 of the GDPR, anonymised data is personal data (e.g. date of birth, name, address) that can no longer be assigned to a specific person as a result of changes made. In short: anonymised data no longer allows the identification of a person.

What is the problem

In an interview with the Deutsche Presse Agentur, the Federal Data Protection Commissioner referred to a specific case: it was often unclear whether the use of data to be consented to was actually anonymised. For example, if users were asked when making online purchases whether they agreed to anonymised use of data for market research purposes. At the same time, Kelber admitted that there is currently still a lack of legal guidelines. Companies or data subjects would often not be able to assess the situation properly. Often, supposedly anonymized data are merely pseudonymised.